Re: totally secure email?

> For political reasons, my email must be encrypted as soon as it hits
> the site before it gets dropped in my mailbox, or the sysadmi n will
> read it (snoopy bugger) and find out I'm looking for a job elsewhere.

Get teh unix program "procmail", source available on any comp.sources.misc archive, 
or, probably, at ftp.informatik.rwth-aachen.de /pub/unix/procmail.tar.Z.
 
This program lets you do things like sort your mail into different mailboxes
as soon as it comes in. It's also really easy to use it as a hook for
other programs or shell scripts to operate on mail as soon as it comes
in. It shouldn't be very hard to do what you want, but there are a couple
of things to be aware of here:
1) Your sysadmin can assuredly get around this too if he wants, and get
at your mail even before procmail does. As a general rule of thumb, the
sysadmin can do anything. But getting aroudn this would definitely be more
dificult then simply reading your /spool/mail file. 
2) You obviously don't want to leave your private key in your unix
account, as the sysadmin could just use it to decrypt all your mail
and read it. Obvious of course, but sometimes it's easy to overlook the
obvious.
 
Of course the best solution would be to have your correspondents send you
PGP encrypted mail, but I guess the best solution isn't always available.

Jonathan Rochkind wrote:

...

> 2) You obviously don't want to leave your private key in your unix
> account, as the sysadmin could just use it to decrypt all your mail
> and read it. Obvious of course, but sometimes it's easy to overlook the
> obvious.
>  
> Of course the best solution would be to have your correspondents send you
> PGP encrypted mail, but I guess the best solution isn't always available.

And an even better solution is for folks to have their own private
machines and access to one of the cheap Internet service providers
springing up all around. Then they won't have to worry about their
corporations "snooping" in their e-mail files. Or restricting them
about using PGP or other crypto.

Corporations have a legitimate reason to tell employees what they can
and can't use. After all, corporations are held liable for most
employee actions (so those death threats to whitehouse.gov will
reflect back on the company) and have other concerns as well
(espionage, extortion, bribery, too much use of the Net, etc.).

Having your own computer means never having to say you're sorry.

(I fear laws telling corporations they *can't* snoop as much as I fear
Clipper. The reasons are obvious, to me at least, and I can expand on
this point if anyone's really interested.)

--Tim May



-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE-----

> (I fear laws telling corporations they *can't* snoop as much as I fear
> Clipper. The reasons are obvious, to me at least, and I can expand on
> this point if anyone's really interested.)

The implications in the field of industrial espionage leap quickly to mind.

Beyond that, unrestrained encryption is dangerous to corporations, because
what's to stop a ticked off employee from encrypting everything in the office
as revenge for some imagined slight?

Encryption as a weapon is something that's not often talked about, despite
the fact that everyone's always rambling about how valuable information
is...

The arguments for restraining encryption in corporate situations can
go on and on... just as the arguments for encouraging private encryption
can go on and on.

    Mark

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Mark Carter
 carterm@spartan.ac.brocku.ca
 PGP key available by finger.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAgUBLgPHYWcmVnbEt/gBAQFu/wP9Febqmdu8LNR7CL2cEpx4fRrQVPnQZp92
rqvkAdxLNZV5UEhkvsyRXOZcbg+CAbvYe0dXrAqOOvSA7B/g+tzvMpup5rUZ3Ydt
tneo3ANnrdaCyrNHoMV2RuavUcYltmdf+EgIg85smUOyvOYQa21K/MtCahzYziXI
HnLB1pll0sQ=
=JWjQ
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

TimM > (I fear laws telling corporations they *can't* snoop as much as
TimM > I fear Clipper. The reasons are obvious, to me at least, and I
TimM > can expand on this point if anyone's really interested.)

MarkC > The implications in the field of industrial espionage leap quickly
MarkC > to mind.

MarkC > Beyond that, unrestrained encryption is dangerous to
MarkC > corporations, because what's to stop a ticked off employee from
MarkC > encrypting everything in the office as revenge for some imagined
MarkC > slight?

Mark Carter makes the same erroreous simplification many people do when
talking about point security.  I see it most often on the Firewalls list.
There, the standard answer to "Should I prevent ftp connections so
employees can't send our proprietary plans off-site?" appears to be "Do
you search your employees at the exit for floppies and magnetic tapes?" 
Security is a web, the strength of which is only as high as the biggest
gap between threads.

Encryption being available to employees can make industrial espionage
easier only if it opens a new channel (or clears an insecure channel) for
bad apple employees or contractors to get their stolen memos off site. An
encrypted channel is just a channel, and probably not worth it for the spy
(unless higher bandwidth per incident channels like DAT or 8mm tapes risk
exposure).

Mark's rhetorical question about ticked off employees encrypting everything
in sight for revenge shows the same problem.  If an employee can encrypt
the files and lose the key, the employee can instead just delete them or
fill them with garbage.  It is indeed a security risk, but the sabotage can
more easily be performed without strong encryption.

However, strong encryption in the workplace can indeed be used to cause
difficulties.

I'm more worried about situations where a corporate officer or the like
leaves the firm, and "forgets" to let her successor know the pass phrase
for the key used to encrypt the payroll records.  Or, the executive
secretary to the Treasurer could be fired because he was caught trying to
embezzle e-cash, and subsequently refuse to release the key used to
encrypt official financial transactions.  In such situations, a smart
company will have used a secret-sharing scheme to split the key, and will
have escrowed it with their outside counsel and/or a couple of escrow
services.

What other problems can we come up with?


Richard

-----BEGIN PGP SIGNATURE-----
Version: 2.3a-sterno-bait

iQCVAgUBLgPuMvobez3wRbTBAQE7cQQAlvZtNyR06aPMrmm00tByNQ9EP1sHtM20
d3ZlbeFJRzizdd/OvhSN0CaYFDnp+tkoXhRuPtvELOgE+Jp/H2181oyoDM03Z+sP
H+Qsr0kp6pY7EPItzKKaz+8iLPOOPZ3zXnUIzQzbRXYiRjXAOifUzLRmdA8xaFEe
/hLgZV746Js=
=qlOS
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

> employees can't send our proprietary plans off-site?" appears to be "Do
> you search your employees at the exit for floppies and magnetic tapes?" 

I see your point.

> Encryption being available to employees can make industrial espionage
> easier only if it opens a new channel (or clears an insecure channel) for
> bad apple employees or contractors to get their stolen memos off site. An

Encryption could be used as a secure means of storage of accumulated material
(on site) until a security gap can be found, though.  And if anyone does any
snooping, they can't see through the encryption to see if it's really company
secrets, thus protecting the spy.

> (unless higher bandwidth per incident channels like DAT or 8mm tapes risk
> exposure).

Again, encryption is sort of a nice safety net.  They can catch you with the
tape, but they've only got you on suspicion of espionage, and the evidence
is encrypted.

> fill them with garbage.  It is indeed a security risk, but the sabotage can
> more easily be performed without strong encryption.

I was thinking more about data being held hostage.

Encryption offers the possibility of restoring the information... no doubt
for a price of some sort.  Few companies would like to admit to being
blackmailed in this fashion.

Sabotage, on the other hand, is much less flexible, and hence would be the
practice of comparative amateurs.  If you destroy everything, and get caught,
what do you have to bargain with?

    Mark

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Mark Carter
 carterm@spartan.ac.brocku.ca
 PGP key available by finger.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAgUBLgTjWmcmVnbEt/gBAQEbxQP+JNs6QvvpMft3FH7DeEUFvsz37lcLAn9d
KzKFHdGMqA0GTqdQLTaEdCBaZzXWMvCW99VcA63l9BFqwEbV1iNw0qs/dWUQseyR
JR0bc/RWqhW7E20NSTXeNpRbxTD9oRoUz1qkV4Z482SWGPEjuIB8Ri+/gJLID9El
rNaKKEJluoE=
=ewDq
-----END PGP SIGNATURE-----

Earlier I wrote:

> And an even better solution is for folks to have their own private
> machines and access to one of the cheap Internet service providers
> springing up all around. Then they won't have to worry about their
> corporations "snooping" in their e-mail files. Or restricting them
> about using PGP or other crypto.
> 
> Corporations have a legitimate reason to tell employees what they can
> and can't use. After all, corporations are held liable for most
> employee actions (so those death threats to whitehouse.gov will
> reflect back on the company) and have other concerns as well
> (espionage, extortion, bribery, too much use of the Net, etc.).
> 
> Having your own computer means never having to say you're sorry.
> 
> (I fear laws telling corporations they *can't* snoop as much as I fear
> Clipper. The reasons are obvious, to me at least, and I can expand on
> this point if anyone's really interested.)

Several people having asked for an explanation and/or commented here
on their interpretations, I'll explain my position:

* Individuals, groups, corporations are free to set their won
policies, more or less, in a free society. (Not everyone agrees with
this, more's the shame.)

A company can set working hours, working conditions, software to be
used, and so on. It is not the business of government to interfere in
these decisions, nor do "civil rights" enter in...an employee told to
use Microsoft Word and not to use PGP cannot claim his "civil rights"
are being violated.

* I did not say companies _should_ snoop...I said there should not be
laws forbidding snooping--in line with the point above.

Imagine the implications of a law forbidding such "snooping": a
company would presumably be unable to ensure that its policies were
being followed, that it's employees were not violating various laws,
etc.

To be sure, companies may wish to avoid snooping, as the repercussions
on company morale are often severe. Not being a good idea, in general,
does not imply that there "ought to be a law" regulating such things.

(Ditto for searches on leaving premises, which one writer here likened
to snooping. Indeed, the two are the same. For 12 years at Intel, my
briefcase was searched--sometime thouroughly, usually cursorily--every
time I left a building with it. Not hard to see, given that a single
uP could be sold for $500 and a briefcase of them could be worth a
small fortune. Floppy disks and the like were generally ignored, as
determining the contents would be too difficult, etc. A lot more I
could say here, but I won't. Searches of briefcases was a "condition
of employment" and not a civil rights issue....except for female
employees, whose handbags were exempted by external law from any
search...assembly workers were often suspected of stealing packaged
devices, but Intel was forbidden to check their bags!)

* In summary, it's a real bad idea--ethically and practically--to deny
"corporations" behaviors we take for granted for ourselves. If I hire
someone to help me in my home, I can set the conditions of the job:
what hours, what rate of pay, what tools can and can't be used, and
what limits I may wish to place on his use of my modems to communicate
with outside services or agents. Corporations are not really
different.

We may not like big corporations...most new companies are formed by
people fed up big companies...but this does not mean we should
interfere with how they run their businesses. Not working for them is
always an option. (I am sympathetic to many anarchist views, such as
those held by my friend Dave Mandl, but I am not at all convinced by
left-leaning arguments that "sometimes people have no choice " in the
jobs they take. Thus, I am a standard libertarian here.)

In considering whether crypto should be "allowed" or "not allowed" for
corporations, a better answer is: that's not for society and the law
to concern itself with. Companies that snoop too much will lose
employees, and companies that are told they cannot monitor what
employees are doing and what tools are being used will also lose out.

Finally, all the arguments about there being _other_ ways for
corporate secrets to leak out are accurate, but beside the point. Of
course there are, and I have done extensive writing on this (BlackNet,
information markets, Gibson-style "escrow" of key employees, etc.).
But that employees can use their home computers to sell corporate
secrets is somthing they will have to learn to deal with somehow (*),
not a reason to limit corporations' abilities to set policy in their
workplaces.

(*) One possibility, the Gibson scenario mentioned (cf. "Count Zero"),
is to require key employees in extremely sensitive positions to forego
access to outside contacts. It may not work very will, and it may be
distasteful to many or most people, but it's not a violation of "civil
rights."

Along with "democracy," the term "civil rights" is bandied about too
much and is used to justify entirely too much State intervention.
Mutually agreed-upon contracts always take precedence over democracy
and civil rights. 


--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

> Finally, all the arguments about there being _other_ ways for
> corporate secrets to leak out are accurate, but beside the point. Of
> course there are, and I have done extensive writing on this (BlackNet,
> information markets, Gibson-style "escrow" of key employees, etc.).
> But that employees can use their home computers to sell corporate
> secrets is somthing they will have to learn to deal with somehow (*),
> not a reason to limit corporations' abilities to set policy in their
> workplaces.
> 
> (*) One possibility, the Gibson scenario mentioned (cf. "Count Zero"),
> is to require key employees in extremely sensitive positions to forego
> access to outside contacts. It may not work very will, and it may be
> distasteful to many or most people, but it's not a violation of "civil
> rights."

Clancy mentioned a scenario that corporations (and others) might be able to
take advantage of - the so-called "Canary Trap".  Instead of identical copies
of a sensitive memo being made, slightly different copies are prepared
instead.  The meaning isn't changed, but the precise wording is, so that if
someone quites verbatim, the precise wording will indicate which document
was leaked, and hence the leaker.  I know for a fact that the United States
and Canada use this for their classified material, at least some of it.

> Along with "democracy," the term "civil rights" is bandied about too
> much and is used to justify entirely too much State intervention.
> Mutually agreed-upon contracts always take precedence over democracy
> and civil rights. 

This is not entirely true, as the courts have ruled that certain contractual
agreements, even when made between consensual parties, may be null and
void, because they go against public policy.  Consider if I contract with
you to kill someone, and at the conclusion of the contract I will pay you
a certain amount of money.  So, you wax the guy, and come to me with his ear
or left testicle or whatever, demanding payment.  I give you the finger, and
instead of putting a .22 hollowpoint between my eyes, you take me to court.
The courts would rule that the contract had no force of law, because it
essentially was a contrat to do something that was against public policy.
Same with illegal "contracts" some companies coerce people into signing as
a condition of employment.  The companies can argue that the employees signed
them of their own free will, but the courts would hold that if the act was
illegal, there can be no binding contract.
-- 
Ed Carp, N7EKG/VE3	ecarp@netcom.com, Ed.Carp@linux.org

"What's the sense of trying hard to find your dreams without someone to share
it with, tell me, what does it mean?"        -- Whitney Houston, "Run To You"

Ed Carp writes:

> Clancy mentioned a scenario that corporations (and others) might be able to
> take advantage of - the so-called "Canary Trap".  Instead of identical copies
> of a sensitive memo being made, slightly different copies are prepared
> instead.  The meaning isn't changed, but the precise wording is, so that if
> someone quites verbatim, the precise wording will indicate which document
> was leaked, and hence the leaker.  I know for a fact that the United States
> and Canada use this for their classified material, at least some of it.

The "canary trap" is also called "barium" (coined by the KGB). Tagging
is sometimes useful, but can be found by XORing two or more
copies.

> > Along with "democracy," the term "civil rights" is bandied about too
> > much and is used to justify entirely too much State intervention.
> > Mutually agreed-upon contracts always take precedence over democracy
> > and civil rights. 
> 
> This is not entirely true, as the courts have ruled that certain contractual
> agreements, even when made between consensual parties, may be null and
> void, because they go against public policy.  Consider if I contract with

Sure, courts have interfered with contracts. Some of these
interferences I even agree with, slightly (while I'm mostly an
anarchist, I support a few laws).

But my point was a judgement ("entirely too much" is a cue), not a
statement of realpolitik.

...
> The courts would rule that the contract had no force of law, because it
> essentially was a contrat to do something that was against public policy.
> Same with illegal "contracts" some companies coerce people into signing as
> a condition of employment.  The companies can argue that the employees signed
> them of their own free will, but the courts would hold that if the act was
> illegal, there can be no binding contract.

Crypto anarchy means a bypassing of such courts. Money held in escrow,
and reputatable (though anonymous) escrow agents will make such
contracts enforceable by other means.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE-----

> 1) Your sysadmin can assuredly get around this too if he wants, and get
> at your mail even before procmail does. As a general rule of thumb, the
> sysadmin can do anything. But getting aroudn this would definitely be more
> dificult then simply reading your /spool/mail file. 

True, but I don't know if he'd think of this one...

> 2) You obviously don't want to leave your private key in your unix
> account, as the sysadmin could just use it to decrypt all your mail
> and read it. Obvious of course, but sometimes it's easy to overlook the
> obvious.

I'm curious - all the stuff that comes with PGP says to not let your secret
key /pass phrase out of your sight, but why is it necessary to guard your
secret key so carefully?  After all, you have to type your pass phrase to
use the secret key, so without the pass phrase, the secret key is useless,
isn't it?  I mean, besides just destroying it...

> Of course the best solution would be to have your correspondents send you
> PGP encrypted mail, but I guess the best solution isn't always available.

Well, that's already happening, but it's hard to stop someone from dropping
a piece of email in your mailbox saying, "xxx gave me your resume, and it
looks good.  Can we talk?"
- -- 
Ed Carp, N7EKG/VE3	ecarp@netcom.com, Ed.Carp@linux.org

"What's the sense of trying hard to find your dreams without someone to share
it with, tell me, what does it mean?"        -- Whitney Houston, "Run To You"

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAgUBLgNiKCS9AwzY9LDxAQEKsAP7BXrjLGdocYRalC6A/aa1Qoa+U3sPBEGv
PI55xfBPhJ5EVWUHWxYRCB8a4nXTw41teuoBY2e40zmeVNtF+syrn1APntnq1pif
CpxMc4WrGQw58rteDrzOysrwrXLsh/oxErrCQ8fEvMXKCe5uXMCHLa+cb6DHq+D0
poizF1fFlrU=
=YYf6
-----END PGP SIGNATURE-----

> > 1) Your sysadmin can assuredly get around this too if he wants, and get
> > at your mail even before procmail does. As a general rule of thumb, the
> > sysadmin can do anything. But getting aroudn this would definitely be more
> > dificult then simply reading your /spool/mail file. 
> 
> True, but I don't know if he'd think of this one...

As long as you are aware of the risks and accept them.. no
problem.  But "I don't know if he'd think of this" is hardly
cryptographically secure..

> I'm curious - all the stuff that comes with PGP says to not let your secret
> key /pass phrase out of your sight, but why is it necessary to guard your
> secret key so carefully?  After all, you have to type your pass phrase to
> use the secret key, so without the pass phrase, the secret key is useless,
> isn't it?  I mean, besides just destroying it...

Well no.. without the secret key file, you have to factor the
public modulus to find the secret key.   We all know how are
that is..  if he already has the encrypted key file though...
then he just has to guess your password.  Far less work, unless
of course you picked a pass phrase a few hundred letters long.

In general, it is impossible to achieve total security on a
multi-user system unless you are the sysadmin yourself.  You
either have to forget it entirely or decide what risks you're
willing to take and what risks you're not.

Good luck.

-- 
 Baba baby mama shaggy papa baba bro baba rock a shaggy baba sister
shag saggy hey doc baba baby shaggy hey baba can you dig it baba baba
        E7 E3 90 7E 16 2E F3 45   *   28 24 2E C6 03 02 37 5C 
   Stuart Smith                           <stu@nemesis.wimsey.com>